kbrain

CVE-2017-12617

HIGH · CVSS 8.1CISA KEV: actively exploitedEPSS 100.0%EU EUVD: exploited

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

Key facts

CVSS score
8.1 (v3.1)
Severity
HIGH
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE)
CWE-434
EPSS score
100.0% (100th percentile)
In CISA KEV
Yes, added March 25, 2022
In EU EUVD
Yes (EUVD-2022-5811)
Published
October 4, 2017
NVD last modified
August 25, 2026
Status
Analyzed

CISA Known Exploited Vulnerability

Apache Tomcat Remote Code Execution Vulnerability

Added to the KEV catalog on March 25, 2022; federal remediation due April 15, 2022.

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2022-5811 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on October 21, 2025.

View on the EU Vulnerability Database

Affected products

  • apache / tomcat
  • canonical / ubuntu linux
  • canonical / ubuntu linux
  • canonical / ubuntu linux
  • canonical / ubuntu linux
  • debian / debian linux
  • netapp / active iq unified manager
  • netapp / active iq unified manager
  • netapp / element
  • netapp / oncommand balance
  • netapp / oncommand insight
  • netapp / oncommand shift
  • netapp / oncommand workflow automation
  • netapp / snapcenter
  • oracle / agile product lifecycle management
  • oracle / agile product lifecycle management
  • oracle / agile product lifecycle management
  • oracle / agile product lifecycle management
  • oracle / communications instant messaging server
  • oracle / endeca information discovery integrator
  • oracle / endeca information discovery integrator
  • oracle / enterprise manager for mysql database
  • oracle / financial services analytical applications infrastructure
  • oracle / fmw platform
  • oracle / fmw platform
  • oracle / health sciences empirica inspections
  • oracle / hospitality guest access
  • oracle / hospitality guest access
  • oracle / instantis enterprisetrack
  • oracle / instantis enterprisetrack
  • oracle / management pack
  • oracle / micros lucas
  • oracle / micros retail xbri loss prevention
  • oracle / micros retail xbri loss prevention
  • oracle / micros retail xbri loss prevention
  • oracle / micros retail xbri loss prevention
  • oracle / micros retail xbri loss prevention
  • oracle / micros retail xbri loss prevention
  • oracle / mysql enterprise monitor
  • oracle / retail advanced inventory planning
  • oracle / retail advanced inventory planning
  • oracle / retail advanced inventory planning
  • oracle / retail advanced inventory planning
  • oracle / retail back office
  • oracle / retail back office
  • oracle / retail central office
  • oracle / retail central office
  • oracle / retail convenience and fuel pos software
  • oracle / retail eftlink
  • oracle / retail eftlink

and 101 more…

Certified products that may be affected

1 FIPS 140 or Common Criteria certified product, from automated matching by sec-certs.org.

References

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain
CVE-2017-12617: HIGH severity (CVSS 8.1)